Data Processing Agreement

Last updated: August 22, 2021

This Data Processing Agreement ("DPA") supplements the Terms of Service for customers that use services operated by Anthony Kung ("we", "us", or "our") and require contractual data processing terms under applicable privacy or data protection law.

This page sets out our standard baseline data processing terms. It is intended to describe the typical allocation of responsibilities between a customer that determines the purposes and means of processing and a service provider that processes personal data on the customer's behalf in order to deliver the Services.

This DPA is not intended to create obligations that do not otherwise apply under law or contract, and it may be supplemented or replaced by a separate signed agreement where required for a particular customer relationship.

Related documents: Terms of Service, Privacy Policy, and Security Disclosure Policy.

1. Applicability and Roles

To the extent that applicable data protection law applies and the customer submits or makes available personal data through the Services, the parties acknowledge the following role allocation unless a different allocation is expressly agreed in writing:

the customer acts as controller with respect to customer personal data it submits to the Services
we act as processor when processing that data on the customer's behalf to provide the Services
we may separately act as controller for limited business operations data, such as account administration, billing, fraud prevention, support, compliance, and security logs

The specific role may depend on the product configuration and the nature of the processing at issue.

2. Subject Matter and Duration of Processing

We process customer personal data for the duration of the customer's use of the relevant Services and for any additional period reasonably necessary to support deletion workflows, backup and recovery, incident response, fraud prevention, legal compliance, or other legitimate operational requirements.

The subject matter of processing consists of the personal data the customer or its users submit, transmit, store, generate, or otherwise make available through the Services in connection with authorized use.

3. Nature and Purpose of Processing

Depending on the Services used, processing may include collection, recording, organization, storage, adaptation, retrieval, consultation, transmission, analysis, restriction, deletion, or destruction of personal data.

Those operations are performed solely to the extent reasonably necessary to:

provide and operate the Services
authenticate and support users
maintain reliability and service functionality
monitor, secure, and protect the Services
investigate abuse, fraud, or incidents
comply with applicable law and enforce contractual rights

We will not process customer personal data for unrelated purposes except as required by law or as otherwise permitted by a separate agreement.

4. Categories of Data and Data Subjects

The categories of personal data processed depend on what the customer chooses to submit through the Services. Depending on the product and use case, categories may include:

account and contact information
user identifiers
support communications
uploaded files, prompts, and structured content
device, usage, and log data
business records or operational data chosen by the customer

Data subjects may include the customer's users, employees, contractors, customers, end users, or other individuals whose data the customer chooses to submit.

Customers should not submit sensitive or special-category data unless the relevant Service expressly supports that use and the parties have agreed on appropriate safeguards where required.

5. Customer Instructions and Responsibilities

The customer is responsible for determining whether the Services are appropriate for the nature of the personal data it chooses to process and for ensuring that it has a lawful basis, any required notices, and any required consents or permissions.

The customer instructs us to process customer personal data as necessary to provide the Services in accordance with the relevant agreement, applicable documentation, and the customer's use of product features. Additional instructions outside the normal scope of the Services may require separate agreement.

6. Confidentiality and Personnel Access

We take reasonable steps to ensure that persons authorized to process customer personal data are subject to appropriate confidentiality obligations and are limited to those who need access to perform their duties.

Access to customer personal data is limited on a need-to-know basis and may be governed by technical controls, role-based permissions, operational procedures, and logging.

7. Security Measures

We maintain reasonable technical and organizational measures designed to protect customer personal data against unauthorized or unlawful access, accidental loss, destruction, alteration, or disclosure. Security is risk-based and may evolve over time as threats, systems, and products change.

Examples of measures may include:

encryption in transit where appropriate
access controls and authentication safeguards
logging and monitoring
backup and recovery procedures
vulnerability management and incident response practices

No security measure is infallible, and no environment can be guaranteed to be completely secure.

8. Subprocessors

We may use subprocessors to support delivery of the Services, including providers of hosting, storage, analytics, communications, authentication, support tooling, and AI or compute infrastructure.

Where we engage subprocessors to process customer personal data, we will take reasonable steps to require them to protect that data through contractual obligations or comparable safeguards appropriate to the nature of the processing.

9. International Transfers

Customer personal data may be processed in the United States and in other jurisdictions where we or our subprocessors operate. Where applicable law requires a transfer mechanism for cross-border transfers, the parties will rely on a lawful transfer mechanism reasonably appropriate to the circumstances.

10. Assistance With Data Subject Requests and Compliance

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance to help the customer respond to data subject requests or compliance obligations where required by law and where the customer cannot reasonably fulfill those obligations without our support.

Such assistance may be subject to technical feasibility, proportionality, and reimbursement where extensive or bespoke work is required.

11. Incidents

If we become aware of a confirmed security incident affecting customer personal data, we will take reasonable steps to investigate, mitigate, and, where required by law or contract, notify the customer without undue delay. Our notification may be delayed as necessary to prevent additional harm, preserve evidence, or comply with legal or law-enforcement constraints.

12. Deletion and Return

Upon termination of the applicable Services, customer personal data may be deleted, anonymized, or rendered inaccessible after a reasonable retention period, unless retention is required for backup integrity, security, fraud prevention, legal compliance, dispute resolution, or other legitimate business purposes.

13. Contact

Questions about privacy or data processing terms may be sent to support@anth.dev.